Webroot Inc.

Cybersource Corporation

Other

Open Text Corporation

Raise Marketplace, LLC

William Alfred Wright

John W Pettit

Michael W Lewis

Thomas A Arnold

Frank M King

George D Kellerman

Bin Qiu

Thomas Caldwell

Hung-Tzaw Hu

Hossein Eslambolchi

Michael Pe Jimenez

Louie Gasparini

Lars Wright

Chandra Madhekar

Christopher Jigme Wright

Robert John Ford

Examples of the present disclosure describe systems and methods for state-based entity behavior analysis. In an example, entities of a computing environment may be represented using a hierarchical entity web. In some examples, an entity may have a state associated with it, which may be modeled using a place/transition (PT) network. Events within the computing environment may be evaluated by transitions of a PT network to determine whether an entity should change state. If an entity transitions from one state to another, one or more actions may be performed, including, but not limited to, taking a remedial action, generating a recommendation, and updating the state of one or more associated entities. Thus, aspects disclosed herein may provide a high-level overview of the state of entities of a computing environment, but may also be used to view in-depth information of entities at lower levels of the hierarchical entity web.

State-based entity behavior analysis

Examples of the present disclosure describe systems and methods for identifying anomalous network behavior. In aspects, a network event may be observed network sensors. One or more characteristics may be extracted from the network event and used to construct an evidence vector. The evidence vector may be compared to a mapping of previously-identified events and/or event characteristics. The mapping may be represented as one or more clusters of expected behaviors and anomalous behaviors. The mapping may be modeled using analytic models for direction detection and magnitude detection. One or more centroids may be identified for each of the clusters. A 'best fit' may be determined and scored for each of the analytic models. The scores may be fused into single binocular score and used to determine whether the evidence vector is likely to represent an anomaly.

Statistical analysis of network behavior using event vectors to identify behavioral anomalies using a composite score

A method includes receiving, by a computing entity, a transaction for fraud evaluation. The method further includes generating, by the computing entity, evidence vectors regarding the transaction, wherein an evidence vector is a piece of information regarding a topic, or portion thereof, of a list of topics. The method further includes engaging, by the computing entity, tools to generate risk analysis responses based on the evidence vectors. The method further includes discarding, by the computing entity, indeterminate responses of the risk analysis responses to produce a group of risk analysis responses. The method further includes interpreting, by the computing entity, the group of risk analysis responses to produce a fraud evaluation answer of low risk of fraud, high risk of fraud, or further analysis is required.

Predictive fraud analysis system for data transactions

A system for identifying a network intrusion includes four modules. The first module monitors network transmissions and creates a model of regular network activity. The second module receives the model of regular network activity and sets a threshold for irregular usage based on the model. The third module receives the threshold, compares a value of a candidate inter-nodal transmission of the network to the threshold, and identifies a potential intrusion when the value exceeds the threshold. The fourth module analyzes a transmission behavior of one or more nodes of the candidate inter-nodal transmission and identifies the network intrusion.

Network intrusion detection

A luminous insect trap for flying or crawling insects includes a hollow cylindrical enclosure having cylindrical side walls and upper and lower ends, a roof member removably closing the upper end, a removable electrical light source within the enclosure, an electrical power source providing electrical power to the light source, transparent, white or lightly colored, flexible glue boards removably overlying a major portion of the cylindrical walls; a bottom wall including a generally centrally disposed aperture, the aperture being just large enough to allow relatively large insects to pass therethrough, the centrally disposed portion of the bottom wall projecting inwardly into the enclosure for defining an annular space between the inwardly projecting bottom wall and the side walls of the enclosure, and a plurality of wall apertures spaced apart about the periphery of the cylindrical walls just below the bottom of the roof member.

Luminous insect trap

Evaluating fraud risk in a transaction between consumer and a merchant over a network is disclosed. The merchant requests service over the network using a secure, open messaging protocol. An e-commerce transaction or electronic purchase order is received from the merchant, the level of risk associated with each order is measured, and a risk score is returned to the merchant. In one embodiment, data validation, highly predictive artificial intelligence pattern matching, network data aggregation and negative file checks are used to examine numerous factors to calculate fraud risk. A risk score is generated and compared to the merchant's specified risk threshold. The result is returned to the merchant for order disposition.

Method and apparatus for generating a bi-gram score in fraud risk analysis

Transaction information is received and applied to multiple fraud risk mathematical models that each produce a respective raw score, which are transformed with respective sigmoidal transform functions to produce optimized likelihood of fraud risk estimates to provide to a merchant. Respective fraud risk estimates are combined using fusion proportions associated with the respective risk estimates, producing a single point risk estimate, which is transformed with a sigmoidal function to produce an optimized single point risk estimate. The sigmoidal functions approximate a relationship between risk estimates produced by fraud risk detection models and a percentage of transactions associated with respective risk estimates; the relationship is represented in terms of real-world distributions of fraudulent and non-fraudulent transaction.

Method and apparatus for evaluating fraud risk in an electronic commerce transaction

A technique for evaluating fraud risk in e-commerce transactions between consumer and a merchant is disclosed. The merchant requests service from the system using a secure, open messaging protocol. An e-commerce transaction or electronic purchase order is received from the merchant, the level of risk associated with each order is measured, and a risk score is returned. In one embodiment, data validation, highly predictive artificial intelligence pattern matching, network data aggregation and negative file checks are used. The system performs analysis including data integrity checks and correlation analyses based on characteristics of the transaction. Other analysis includes comparison of the current transaction against known fraudulent transactions, and a search of a transaction history database to identify abnormal patterns, name and address changes, and defrauders. In one alternative, scoring algorithms are refined through use of a closed-loop risk modeling process enabling the service to adapt to new or changing fraud patterns.

According to one aspect, transaction information is received and applied to multiple fraud risk mathematical models that each produce a respective raw score, which are transformed with respective sigmoidal transform functions to produce optimized likelihood of fraud risk estimates to provide to a merchant. In one embodiment, the respective fraud risk estimates are combined using fusion proportions that are associated with the respective risk estimates, producing a single point risk estimate, which is transformed with a sigmoidal function to produce an optimized single point risk estimate for the transaction. The sigmoidal functions are derived to approximate a relationship between risk estimates produced by fraud risk detection models and a percentage of transactions associated with respective risk estimates, where the relationship is represented in terms of real-world distributions of fraudulent transaction and non-fraudulent transaction. One embodiment is directed to computing respective risk test penalties for multiple risk tests in one or more of the multiple fraud risk mathematical models used to estimate the likelihood of fraud, given a certain pattern of events represented by the transaction information, wherein the respective risk test penalties are computed as the inverse of the sum of one and a false positive ratio for the respective risk test.

A method and apparatus are disclosed for communicating state information in an electronic message. First data representing a state of an electronic transaction is encoded, to result in creating an encoded message element that is impractical for a recipient to decode. For example, steganographic invisibility encoding may be used. The encoded message element is sent as part of a first message associated with the transaction. A second message associated with the transaction is received, and the third message includes the encoded message element. The encoded message element is decoded, to result in recovering the state of the transaction, which is used in processing the second message. As a result, large volumes of state information are sent to clients for local, transitory storage, precluding the need for a large state data store on the server side.

Growing community of inventors

Los Gatos, CA, United States of America

William Alfred Wright